dsh-featherhunter-plugin-base 0.0.1 → 0.0.2-drill

package/data/manifest.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
-  "version": "0.0.1",
-  "revision": 1,
-  "updatedAt": "2026-10-23T00:00:00+08:00",
+  "version": "0.0.2-drill",
+  "revision": 2,
+  "updatedAt": "2026-10-31T00:00:00+08:00",
   "fallbackUrl": "https://github.com/FeatherHunter/featherhunter-plugin-manage",
   "groups": [
     {
@@ -77,10 +77,10 @@
         "zh": "DSH 插件交流群微信群二维码",
         "en": "DSH plugin community group WeChat QR code"
       },
-      "card": "card-wechat-2026-10-23.png",
+      "card": "card-wechat-2026-11-06.png",
       "qr": {
         "kind": "remote",
-        "path": "qr-wechat-2026-10-23.png"
+        "path": "qr-wechat-2026-11-06.png"
       },
       "title": {
         "zh": "DSH 插件交流群",
@@ -90,7 +90,7 @@
         "zh": "群聊：DSH 插件交流群",
         "en": "Group chat: DSH Plugin Community"
       },
-      "validUntil": "2026-10-30"
+      "validUntil": "2026-11-06"
     }
   ],
   "plugins": [

package/dist/client/content.d.ts

@@ -0,0 +1,116 @@
+import type { Manifest } from "../core/types";
+/**
+ * Remote manifest transport (ticket 05).
+ *
+ * The contact modal must always paint the bundled baseline first and only then
+ * swap in the published manifest. Everything in this module is therefore
+ * best-effort: any failure (timeout, HTTP error, invalid JSON, invalid data,
+ * oversized image) silently degrades to the baseline, never to an error state.
+ */
+/** Published package name; the CDN URLs below are derived from it. */
+export declare const PACKAGE_NAME = "dsh-featherhunter-plugin-base";
+/** One request may take at most 1.5s; there are no retries. */
+export declare const MANIFEST_TIMEOUT_MS = 1500;
+/** A fetched manifest (success or failure) is reused for 30 minutes. */
+export declare const MANIFEST_CACHE_TTL_MS: number;
+/** Hard cap for a single QR image, enforced before it is shown. */
+export declare const MAX_IMAGE_BYTES: number;
+/** The only hosts the client is allowed to talk to (images and manifest). */
+export declare const ALLOWED_CDN_HOSTS: readonly string[];
+/** Minimal structural view of a fetch Response; easy to fake in tests. */
+export interface FetchResponseLike {
+    ok: boolean;
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+    text(): Promise<string>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+}
+export type FetchLike = (url: string, init?: {
+    signal?: AbortSignal;
+    cache?: string;
+    credentials?: string;
+}) => Promise<FetchResponseLike>;
+/** A loaded and validated manifest plus the QR images prefetched for it. */
+export interface LoadedContent {
+    manifest: Manifest;
+    /** Channel name that produced the manifest ("unpkg" / "npmmirror" / ...). */
+    source: string;
+    /** Timestamp (loader clock) at which the manifest was accepted. */
+    fetchedAt: number;
+    /** Prefetched QR images keyed by "<version>/<path>", values are data URIs. */
+    images: Map<string, string>;
+}
+/** Context handed to a channel loader. */
+export interface ChannelContext {
+    packageName: string;
+    fetchText: (url: string) => Promise<string>;
+    fetchJson: (url: string) => Promise<unknown>;
+}
+/** One CDN channel; the channels are tried in array order. */
+export interface ManifestChannel {
+    name: string;
+    load: (context: ChannelContext) => Promise<{
+        raw: unknown;
+        url: string;
+    }>;
+}
+export interface ContentLoaderOptions {
+    /** Explicit manifest URL; when set, the default CDN channels are not used. */
+    manifestUrl?: string;
+    packageName?: string;
+    fetchImpl?: FetchLike;
+    timeoutMs?: number;
+    maxImageBytes?: number;
+    /** Clock override (testing seam). */
+    now?: () => number;
+    /** Channel override (testing seam). */
+    channels?: ManifestChannel[];
+}
+/** True for https URLs only. */
+export declare function isHttpsUrl(value: string): boolean;
+/** True when the URL is https and its host is on the CDN allowlist. */
+export declare function isAllowedCdnUrl(value: string): boolean;
+/** Exact-version QR image URLs, primary jsDelivr then the npmmirror mirror. */
+export declare function imageUrls(version: string, path: string, packageName?: string): string[];
+/** The three published channels, in fallback order. */
+export declare function defaultChannels(packageName?: string): ManifestChannel[];
+/**
+ * Validate a remote manifest beyond what parseManifest checks: length limits
+ * for user-visible text, a sane version, safe image paths and https links.
+ * Throws an Error whose message starts with "manifest: ".
+ */
+export declare function validateRemoteManifest(raw: unknown): Manifest;
+/** Drop the module cache; tests use this, production never needs it. */
+export declare function resetContentCache(): void;
+export declare class ContentLoader {
+    readonly packageName: string;
+    readonly timeoutMs: number;
+    readonly maxImageBytes: number;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly channels;
+    constructor(options?: ContentLoaderOptions);
+    /** Cached content when it is still inside the 30 minute window. */
+    getCached(): LoadedContent | null;
+    /**
+     * Fetch and validate the manifest once per 30 minutes; concurrent callers
+     * share one request. Resolves to null when every channel failed.
+     */
+    load(): Promise<LoadedContent | null>;
+    /** Prefetch every remote QR image of a manifest (best effort). */
+    ensureImages(content: LoadedContent): Promise<void>;
+    /** Data URI for a remote QR path, or null when it is not prefetched. */
+    imageFor(content: LoadedContent | null, path: string): string | null;
+    /** Warm the cache: manifest plus images. Never rejects. */
+    preload(): Promise<void>;
+    private loadImage;
+    private fetchImage;
+    private fetchContent;
+    private fetchText;
+    /** One request with the 1.5s abort window; the timer is always cleared. */
+    private request;
+}
+/** Build a loader bound to the published package (or a custom manifest URL). */
+export declare function createContentLoader(options?: ContentLoaderOptions): ContentLoader;

package/dist/client/index.d.ts

@@ -11,3 +11,5 @@ export declare function createBaseUI(React: typeof ReactNamespace, options?: Bas
 export { BASE_CSS, BASE_STYLE_ID, ensureBaseStyles } from "./styles";
 export { MESSAGES, resolveText } from "./texts";
 export type { TextKey, TextOverrides } from "./texts";
+export { ALLOWED_CDN_HOSTS, ContentLoader, MANIFEST_CACHE_TTL_MS, MANIFEST_TIMEOUT_MS, MAX_IMAGE_BYTES, createContentLoader, defaultChannels, imageUrls, isAllowedCdnUrl, isHttpsUrl, resetContentCache, validateRemoteManifest, } from "./content";
+export type { ContentLoaderOptions, FetchLike, FetchResponseLike, LoadedContent, ManifestChannel } from "./content";